CVE-2026-41715

Name of the Vulnerable Software and Affected Versions Reactor Netty versions 1.0.0 through 1.0.51 Reactor Netty versions 1.1.0 through 1.1.35 Reactor Netty versions 1.2.0 through 1.2.17 Reactor Netty versions 1.3.0 through 1.3.5

Description The Reactor Netty HTTP client may leak credentials when handling HTTP redirects from a secure endpoint to an insecure one. This issue occurs only if the HTTP client is explicitly configured to follow redirects.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.